fix(rules): a repo with no GitHub remote is private, not a lookup failure - #289
Merged
Merged
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…lure _repo_visibility() ran `gh repo view` and treated any non-success the same: breadcrumb "gh visibility lookup failed" and return UNKNOWN. But a repo with no GitHub remote at all (e.g. the OMI mesh vault, which pushes only to pluto/seed over SSH) is not a gh failure - gh legitimately cannot classify a non-GitHub repo. That logged a hook failure on every repo-work turn in such a vault (surfaced by `omind doctor`). Add _has_github_remote() to tell the two apart: no GitHub remote -> classify private (public-repo rules then correctly do not fire) and cache it, no breadcrumb; a repo that HAS a GitHub remote yet fails lookup is still a real error -> UNKNOWN + breadcrumb (unchanged fail-open). Tests: vault case is private with no breadcrumb; gh-remote-but-gh-fails still UNKNOWN + breadcrumb. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AVQmw9hU7wCegqem9trv8A
CryptoJones
force-pushed
the
fix/rules-visibility-no-github-remote
branch
from
September 9, 2026 18:36
9cdc3f5 to
76a5480
Compare
CodeQL py/incomplete-url-substring-sanitization (high) on this branch: `"github.com" in proc.stdout.lower()` also matches a host that merely contains the string. `https://github.com.evil.example/x` and `https://not-github.com/x` both passed. That is not cosmetic here. _has_github_remote decides whether a repo is classified at all, which decides repo visibility, which decides whether the public-repo branch+PR deny fires. A misclassified remote turns the deny into silence — the guard reports itself as functioning while enforcing nothing. Remote URLs are now pulled out of `git remote -v` and matched on parsed host (github.com or a subdomain), covering https, scp-like `git@host:path`, embedded credentials, ports and case. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DRXCexxuJWz949htNeqFZj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
omind doctorreportshook failure(s) recorded in the last 7 days, andhook-failures.logis full of:Root cause:
_repo_visibility()runsgh repo view --json visibilityin the repo and treats every non-success identically — breadcrumb a failure and returnUNKNOWN. But the OMI vault has no GitHub remote (it pushes only topluto/seedover SSH), soghreturns "none of the git remotes … point to a known GitHub host." That is expected, not a failure — yet it logged a hook failure on every repo-work turn in the vault (measured: one per OMI commit, all day).Fix
Add
_has_github_remote()and branch on it whenghyields no usable visibility:private(visibility-conditioned public-repo rules then correctly do not fire), cache it, and do not breadcrumb.ghfailed (auth, network) → still a real error:UNKNOWN+ breadcrumb, unchanged fail-open behaviour.Tests
test_no_github_remote_is_private_not_a_failure— vault case returnsprivate, zero breadcrumbs.test_github_remote_but_gh_fails_is_unknown_and_breadcrumbed— genuine failure stillUNKNOWN+ breadcrumb.Full gate green locally:
ruffclean,mypy --strictclean,pytest983 passed / 1 skipped.🤖 Generated with Claude Code
https://claude.ai/code/session_01AVQmw9hU7wCegqem9trv8A
Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/